URLhaus: mirai Malicious URLs

Hunt Hypothesis

This hunt hypothesis targets Mirai malware infections that leverage malicious URLs to compromise IoT devices with weak security configurations, transforming them into botnet nodes capable of executing large-scale DDoS attacks. A SOC team should proactively hunt for these indicators in Azure Sentinel to identify early-stage compromises before they escalate into widespread network disruptions and service outages.

IOC Summary

Threat: mirai Total URLs: 9 Active URLs: 9

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["121.231.142.133", "105.184.102.34", "220.208.179.252", "115.51.95.135", "113.221.72.124", "185.248.14.255", "105.186.235.17", "223.151.76.113", "123.14.231.53"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["121.231.142.133", "105.184.102.34", "220.208.179.252", "115.51.95.135", "113.221.72.124", "185.248.14.255", "105.186.235.17", "223.151.76.113", "123.14.231.53"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule, tailored for an enterprise environment with suggested filters and exclusions:

• IoT Device Firmware Auto-Updates via Vendor Repositories

  • Scenario: Enterprise-managed IoT devices (e.g., Cisco Meraki APs, Ubiquiti UniFi controllers) automatically query their vendor’s update servers to check for firmware patches. These URLs often host large binary payloads and exploit kits that resemble the Mirai attack vector, triggering false positives when the device initiates a connection to firmware.cisco.com or similar domains.
  • Suggested Filter/Exclusion: Create an exclusion rule based on Source IP Ranges (specifically the internal IoT VLAN subnet) and Destination Domain Allowlist. Add known vendor update domains (e.g., *.cisco.com, *.ubnt.com) to a “Trusted Vendor Domains” list in the SIEM correlation engine.

• Scheduled Backup Jobs for Network Infrastructure

  • Scenario: Automated backup scripts running on network appliances (such as Palo Alto Networks firewalls or FortiGate units) utilize external cloud storage services (e.g., AWS S3, Azure Blob) to store configuration snapshots. The HTTP/HTTPS requests generated during these scheduled jobs often involve complex URL parameters and large data transfers that mimic the traffic patterns of Mirai bot communication.
  • Suggested Filter/Exclusion: Implement a time-based exclusion for Scheduled Tasks. Configure the detection rule to suppress alerts originating from specific backup service accounts (e.g., svc-net-backup) during defined maintenance windows (e.g., 02:00–04:00 UTC) or exclude traffic destined for known cloud storage endpoints (*.amazonaws.com, *.azureedge.net).

• **Vulnerability Scanning Tools Probing